﻿using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using System.Security.Claims;

namespace _22_JWT封装.Controllers
{
    [Route("api/[controller]/[action]")]
    [ApiController]

    [Authorize] //需要验证   用postMan来验证接口 自定义报文头：Authorization=Bearer+空格+jwtToken
    public class Demo2Controller : ControllerBase
    {
        [HttpGet]
        public string Test1()
        {
            var claim = this.User.FindFirst(ClaimTypes.Name);

            return "ok" + claim.Value;
        }
        [AllowAnonymous] // 不需要验证
        [HttpGet]
        public string Test2()
        {
            return "ok 不需要验证的返回";
        }

        [HttpGet]
        [Authorize(Roles ="admin")]  //拥有admin角色的才能访问 生成jwt的时候添加 claims.Add(new Claim(ClaimTypes.Role, "admin")) 才行
        public string Test3()
        {
            return "ok 拥有admin角色的才能访问";
        }
    }
}
